OSS + ELC EU 2026

Your AI agent just wrote some code and wants to run it on your machine. It can read your SSH keys, exfiltrate data to any host, and overwrite your project. How do you give it just enough freedom to be useful, and nothing more?

This talk presents Sandlock, an AI agent sandbox for Linux that locks a process down in about 5 milliseconds using nothing but the kernel. No root. No cgroups. No containers. Spinning up a container or microVM per agent action means image builds, privileged setup, and a ~100 ms tax on every launch. Sandlock makes confinement cheap enough to wrap every command an agent runs.

We will show how it composes three kernel features: Landlock for filesystem, network, and IPC scoping; seccomp-bpf for syscall filtering; and seccomp user notification, where a supervisor enforces memory limits, an IP and port allowlist, HTTP-level ACLs with zero-config HTTPS inspection, and a copy-on-write working directory.

Live demos: pin an agent's egress to a single API, give it data access but no network, preview every file it would change before committing, and see real numbers (44x faster startup than Docker).